Privacy Policy

Effective 10 July 2026 · Last updated 10 July 2026

Zarvest Technologies (Private) Limited, operating under the brand name Asasa.

1. Introduction

This Privacy Policy explains how Zarvest Technologies (Private) Limited, operating under the brand name Asasa ("Asasa," "we," "us," or "our"), collects, uses, stores, shares, and protects your personal information when you use our website, web application, mobile application, features, services, or customer support channels (collectively, the "Platform" or "Services").

By accessing the Platform, creating an account, or submitting your information to us, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy should be read together with our Terms of Use, transaction confirmations, invoices, withholding tax deduction records and certificates, wallet statements, custody disclosures, Shariah disclosures and certificates, delivery records, and any other documents or notices made available through the Platform from time to time.

2. Our commitment to privacy

We believe that our users should be able to trust Asasa with their personal and transactional information. We are committed to handling your information responsibly and in accordance with applicable law. Our approach is based on the following principles:

• Transparency: We aim to be clear about what information we collect and how we use it.
• Data Minimization: We collect and process personal information only to the extent reasonably necessary for the purposes described in this Privacy Policy.
• User Control: Where appropriate, we provide you with choices regarding your personal information and communication preferences.
• Security by Design: We seek to build privacy and data protection into our systems, products, and processes.

3. Information we collect

Depending on how you use our Services, we may collect the following categories of information:

Identity and profile information

• Full name;
• Date of birth;
• Gender, where required;
• Profile image, where applicable;
• CNIC, NICOP, passport, or other identification details where required for verification, fraud prevention, or compliance;
• Photograph, selfie, signature, or similar verification-related information where required.

Contact information

• Mobile number;
• Email address;
• Residential address;
• Mailing address;
• City, province, and country.

Financial and account information

• Bank account details;
• IBAN;
• Account title;
• Payment-related information necessary to process transactions, settlements, payouts, and refunds;
• Transaction history and account activity;
• Source-of-funds or related information where required for verification, risk review, or compliance purposes.

Gold, Holdings, and transaction information

• Gold purchase, sell-back, liquidation, custody, wallet, withdrawal, refund, vaulting, insurance, delivery, physical collection, and settlement records;
• Gold quantity and balance, buy and sell prices, spread, fees, taxes, withholding tax deductions, filer / ATL status, CPR / PSID / challan references, order IDs, transaction IDs, wallet entries, invoices, confirmations, and statements, in each case where applicable;
• Information relating to brokers, custodians, vault operators, insurers, logistics and delivery partners, redemption partners, and other third parties involved in the sourcing, storage, insurance, custody, settlement, collection, or delivery of gold;
• Records evidencing user instructions, order and pricing confirmations, risk and withholding-tax acknowledgements, delivery requests, tax certificate downloads, consents, and legal disclosures accepted by you through the Platform.

Verification and compliance information

• Information and documents submitted for identity verification;
• Due diligence and risk assessment information;
• Fraud screening or sanctions screening information;
• Tax-related information where applicable.

Sensitive or regulated information

Certain information we collect may be sensitive or regulated in nature, including national identity information, biometric or facial verification data, financial account information, tax information, source-of-funds information, and transaction data. We collect and process such information only where required or reasonably necessary for identity verification, account security, fraud prevention, AML/CFT compliance, tax compliance, transaction processing, regulatory reporting, or other lawful purposes.

Device and technical information

• IP address;
• Browser type and version;
• Operating system;
• Device type and model;
• App version;
• Browser and session information;
• Unique device identifiers;
• Login activity;
• Crash logs.

Usage information

• Pages or screens viewed;
• Features used;
• Searches, clicks, and interactions;
• Time spent on the Platform;
• Referral source;
• General usage and performance data.

We may also process app screen interactions, button clicks, checkbox acknowledgements, price-quote views, confirmation screens, and receipt or certificate downloads for transaction evidence, auditability, customer support, fraud prevention, and legal compliance.

Communications and support information

• Emails, chats, customer support tickets, and other communications with us;
• Complaint records;
• Feedback, reviews, and survey responses.

Permissions-based information

If you grant permission through your device, we may collect:

• Camera access for document uploads or verification purposes;
• Photo gallery or file access for uploads;
• Microphone access where needed for a specific feature;
• Approximate location inferred from your IP address or device, collected solely for fraud prevention, security monitoring, and identity verification purposes. We do not collect precise GPS location unless you explicitly grant such permission for a specific feature that requires it;
• Notification permissions to send important account, service, or transaction-related alerts.

4. How we collect information

We may collect information in the following ways:

Directly from you

When you sign up or create an account; complete your profile; submit identification or verification documents; use features on the Platform; submit a request or instruction; contact customer support; or otherwise interact with our Services.

Automatically

When you use the Platform, we may collect certain information automatically through cookies, web beacons, SDKs, analytics tools, device permissions, and server or application logs.

From third parties

We may obtain information from trusted third parties, including:

• Identity verification providers;
• Payment and settlement partners;
• Fraud prevention vendors;
• Communications service providers;
• Publicly available or legally accessible sources;
• Legal, regulatory, or compliance-related sources where required;
• Government, regulatory, tax, and official databases or systems, including where verification, screening, reporting, or compliance is required or permitted by applicable law;
• Brokers, custodians, vaulting providers, insurers, precious-metals service providers, redemption and minting partners, logistics and delivery partners, and other providers involved in the sourcing, custody, storage, insurance, collection, delivery, redemption, settlement, or administration of Holdings, including for custody reconciliation, insurance coverage and claims, audit, settlement, physical delivery, user support, tax reporting, and regulatory or compliance purposes;
• Your authorised representatives, heirs, nominees, successors, legal representatives, or persons claiming authority in relation to your account, where relevant.

5. How we use your information

We may use your information for the following purposes:

To provide and operate the Services

• Create and manage your account;
• Verify your identity;
• Process your requests, transactions, instructions, settlements, payouts, and refunds;
• Maintain account and transaction records, including records of your Holdings, wallet balances, buy orders, sell-back and liquidation instructions, withdrawals, refunds, vaulting and insurance deductions, custody arrangements, and transaction confirmations;
• Provide customer support and respond to inquiries.

To verify identity and manage risk

• Conduct identity verification and due diligence;
• Detect, prevent, and investigate fraud, misuse, suspicious activity, or unauthorized access;
• Protect users, the Platform, and our business from security threats or unlawful activity;
• Conduct anti-money laundering and sanctions screening, source-of-funds reviews, transaction monitoring, and financial-crime investigations.

To comply with legal and regulatory requirements

• Comply with applicable laws, lawful requests, court orders, and regulatory directions;
• Maintain records for audit, accounting, tax, legal, and compliance purposes;
• Deduct, collect, deposit, report, reconcile, and evidence withholding tax and other taxes where applicable;
• Prepare, issue, verify, maintain, report, or provide invoices, withholding tax deduction records and certificates, CPR / PSID / challan references, account statements, transaction confirmations, custody records, wallet statements, delivery records, and other records required for tax, accounting, audit, compliance, user support, or regulatory purposes;
• Enforce our Terms and protect our rights.

To improve and develop the Platform

• Understand how users interact with the Platform;
• Troubleshoot bugs and technical issues;
• Improve design, functionality, performance, and user experience;
• Conduct analytics, testing, research, and product development;
• Develop, test, and improve pricing displays, order flows, wallet records, custody records, tax records, risk controls, support tools, and compliance processes, using aggregated or anonymized data where appropriate.

To communicate with you

• Send service, account, and transaction notifications;
• Send verification and security alerts;
• Respond to support requests, complaints, and operational issues;
• Notify you of changes to our Services, Terms, or policies.

To send marketing communications

Send you promotional messages, educational material, product updates, or offers relating to our Services, where permitted by law and subject to your communication preferences. You may opt out of non-essential marketing communications at any time.

6. Grounds for processing

We may process your personal information on one or more of the following grounds, as applicable:

• Your consent;
• Performance of a contract with you, or steps taken at your request before entering into a contract;
• Compliance with legal or regulatory obligations;
• Processing necessary for AML/CFT, sanctions, fraud prevention, tax, accounting, audit, cybersecurity, dispute resolution, consumer protection, record-keeping, regulatory reporting, and law-enforcement purposes;
• Processing necessary to establish, exercise, or defend legal claims, or to protect our rights, our users, our service providers, and the integrity of the Platform;
• Our legitimate operational needs, including fraud prevention, security, service administration, analytics, and product improvement, where such processing is consistent with your reasonable expectations and applicable Pakistani law.

7. How we share your information

We do not sell your personal information to third parties. We may share your information on a need-to-know basis, subject to appropriate safeguards, confidentiality arrangements, and applicable law, in the following circumstances:

Service providers

We may share your information with trusted third parties who help us operate the Platform or provide Services, including:

• Cloud hosting providers;
• Payment processors;
• Payment, settlement, and infrastructure partners;
• Identity verification and compliance service providers;
• Fraud monitoring and security providers;
• Analytics and communications providers;
• Customer support tools;
• Brokers, custodians, vaulting providers, insurers, precious-metals service providers, redemption and minting partners, and logistics and delivery partners involved in the sourcing, custody, storage, insurance, collection, delivery, redemption, settlement, or administration of Holdings.

Corporate affiliates

We may share information with our affiliates or related group entities for internal administration, service support, fraud prevention, compliance, analytics, and business operations.

Professional advisors

We may share information with lawyers, auditors, consultants, and similar professional advisors on a confidential basis.

Business transfers

We may disclose or transfer information in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to appropriate confidentiality protections.

Legal and safety-related disclosures

We may disclose your information where required or permitted by law, or where we believe in good faith that disclosure is necessary to:

• Comply with law, regulation, court order, or lawful request;
• Comply with requests, notices, audits, inquiries, reporting requirements, or directions from FBR, FMU, law enforcement agencies, regulators, courts, tax authorities, AML/CFT authorities, banks, payment systems, custodians, or other competent authorities;
• Protect our rights or property;
• Investigate violations of our Terms or policies;
• Prevent fraud, security incidents, or illegal activity;
• Protect the safety, security, or integrity of users, third parties, or the Platform;
• Comply with tax, audit, financial-crime, sanctions, anti-money laundering, or regulatory reporting requirements.

With your consent

We may share your information with third parties where you specifically instruct, authorize, or consent to such sharing. Where you request physical collection, redemption, transfer, or delivery of Holdings, we may share relevant information with logistics, security, vaulting, fulfillment, or other service providers necessary to process your request.

8. Cookies and similar technologies

We and our authorized service providers may use cookies, SDKs, pixels, local storage, and similar technologies to:

• Recognize you as a user;
• Keep you signed in;
• Remember preferences;
• Maintain platform functionality;
• Improve performance and user experience;
• Detect fraud and unauthorized activity;
• Understand usage trends and measure the effectiveness of campaigns.

You can control or disable cookies through your browser or device settings. Please note that disabling certain cookies or permissions may affect the functionality of the Platform. We currently do not respond to "Do Not Track" (DNT) browser signals.

9. Cross-border storage and processing

Your personal information may be stored or processed in Pakistan and, where operationally necessary, in other jurisdictions through our service providers or technology infrastructure partners. Such processing may occur through cloud infrastructure providers, communication providers, analytics providers, identity verification providers, compliance providers, or other technology and operational service providers.

Where information is processed outside Pakistan, we will take reasonable steps to ensure appropriate contractual, technical, and organisational safeguards are in place, including data-processing arrangements with service providers requiring them to protect your information to standards consistent with this Privacy Policy and applicable Pakistani law. Cross-border processing will remain subject to any data-localisation, transfer-approval, sectoral, or regulatory requirements that may apply from time to time.

10. Protecting your information

We maintain reasonable technical, organizational, physical, and administrative safeguards designed to protect your information against unauthorized access, disclosure, misuse, alteration, or destruction. These measures may include:

• Encryption in transit and, where appropriate, at rest;
• Firewalls and secure infrastructure;
• Access controls and permission management;
• Internal confidentiality controls;
• Monitoring, logging, and security reviews.

However, no system or method of electronic transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for protecting your account credentials, passwords, one-time passcodes, and device access.

If we become aware of a security incident affecting your personal information, we may take steps to investigate, contain, and remediate it and, where required by applicable law or where we consider appropriate, notify affected users, service providers, or competent authorities.

11. Data retention and account deletion

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy. As a general guide, we apply the following retention periods:

• Transaction records, account history, and financial information: minimum 7 years from the date of transaction or account closure, in accordance with applicable tax, accounting, and regulatory requirements;
• Gold purchase, sell-back / liquidation, wallet, custody, vaulting, insurance, physical-delivery, invoice, withholding tax deduction record and certificate, CPR / PSID / challan reference, and order confirmation records: minimum 7 years from the date of transaction or account closure, or longer where required for tax, audit, accounting, regulatory, AML/CFT, dispute-resolution, or operational purposes;
• Identity verification and KYC documents: minimum 5 years from account closure or last transaction, whichever is later;
• AML/CFT, sanctions, source-of-funds, source-of-wealth, risk assessment, and screening records: minimum 5 years from account closure, last transaction, or completion of the relevant review, or such longer period as may be required by applicable law or regulator;
• Communications and support records: 3 years from the date of interaction;
• Device, technical, and usage information: 1 year from collection.

These periods may be extended where required by law, ongoing dispute resolution, fraud investigation, regulatory direction, or audit requirements. Where appropriate, we may anonymize or aggregate information so that it no longer identifies you.

Account deletion

You may request closure or deletion of your account by contacting us using the contact details below, or through any account deletion functionality we may provide on the Platform. Please note that:

• Account closure may not result in immediate deletion of all information;
• We may retain information where required for legal, compliance, fraud prevention, audit, accounting, security, dispute-resolution, or operational purposes, including to comply with tax withholding, DNFBP / AML-CFT, sanctions, suspicious-activity review, litigation, law-enforcement, or regulatory obligations, even where you have requested account deletion;
• Certain data may remain temporarily in backups or archives until deleted in accordance with our retention processes.

We will process deletion requests within a reasonable period, subject to applicable legal and operational retention requirements.

12. Your rights and choices

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you;
• Correct or update inaccurate or incomplete information;
• Withdraw consent for optional processing;
• Opt out of marketing communications;
• Request deletion of your personal information where legally permissible.

We will endeavor to respond to all valid requests within 30 days of receipt. In complex cases, this period may be extended by a further 30 days, in which case we will notify you of the extension and the reason. We may need to verify your identity before processing a request.

Some requests may be limited where we are legally required or otherwise entitled to retain certain information. For example, we may decline or limit a request where deletion, correction, restriction, or access would conflict with tax records, withholding tax certificates, transaction records, AML/CFT obligations, fraud investigation, legal privilege, dispute resolution, security obligations, regulatory reporting, or another lawful basis for retention or processing.

13. Marketing preferences

You may opt out of promotional or marketing messages by using the unsubscribe link in our emails, adjusting communication settings within the Platform where available, or contacting us directly.

We may still send you important non-promotional messages relating to your account, security, verification, transactions, legal notices, or important operational updates. You may not opt out of essential service-related communications.

14. Automated decision-making

We may use automated systems and tools to assist with identity verification, fraud detection, risk assessment, transaction monitoring, and account security. These systems may make or inform decisions about your account access, transaction processing, or eligibility for certain features. Such systems may include biometric comparison, facial matching, liveness detection, document authenticity checks, and similar identity verification technologies.

Where a solely automated decision significantly affects you, you may contact us to request manual review, subject to applicable law and to fraud prevention, AML/CFT, sanctions, security, tax, regulatory, and operational requirements. Pending such review, we may continue to restrict, delay, reject, or suspend account activity or transactions where we consider this necessary to protect users, the Platform, or service providers, or to comply with applicable law.

15. Minors

Our Services are not intended for individuals under the age of eighteen (18), and we do not knowingly permit minors to open or operate accounts on the Platform. If we become aware that we have collected personal information from a minor inappropriately, we may suspend the relevant account and take appropriate steps in accordance with applicable law.

16. Legal framework

Zarvest Technologies (Private) Limited operates in Pakistan and seeks to comply with applicable domestic legal frameworks relating to privacy, confidentiality, data handling, electronic transactions, cybersecurity, financial crime prevention, tax, record-keeping, and consumer protection, including the Prevention of Electronic Crimes Act, 2016 and other applicable Pakistani laws, regulations, and regulatory requirements. Pakistan's comprehensive personal data protection legislation remains under development as at the date of this Privacy Policy. We will monitor legal developments, including any enacted personal data protection law, and may update this Privacy Policy and our practices accordingly.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, technology, or applicable legal requirements. Any updated version will be posted on the Platform with a revised Effective Date or Last Updated date, as applicable. Where appropriate, we may also notify you through email, SMS, push notification, or through the Platform. Your continued use of the Services after the updated Privacy Policy becomes effective will constitute your acknowledgment of the updated policy, to the extent permitted by law.

18. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our designated privacy point of contact:

Zarvest Technologies (Private) Limited
Operating under the brand name Asasa
Privacy & General Support: support@myasasa.com
Address: Office 906, Dulara Business Center, 28, Maniya Society Maniya CHS (MCHS), P.E.C.H.S., Karachi, Pakistan

Our privacy point of contact is responsible for overseeing compliance with this Privacy Policy and handling all privacy-related inquiries and data subject requests. When contacting us, please include sufficient information to allow us to verify your identity and understand your request. We may request additional information before processing any privacy-related request.